Last year DRI appointed a Social Media Task Force of lawyers to work on DRI’s policy towards social media and its use to enhance and promote the DRI brand. I have the honor of being a member of that group. Our task force’s collective interest is often piqued when we hear of new trends or developments with social media, such as when we learned this week that the Maryland Department of Corrections joined the increasing number of employers requiring employees or job applicants to provide their usernames and passwords in order to access to their personal Facebook accounts.
There is a growing debate in the United States about whether employer-mandated access to personal social media sites is a violation of privacy rights or principles. In the case of the Maryland Department of Corrections, they required a prospective employee to provide Facebook access during an interview. Soon after the interview, they received a letter of protest from the ACLU.
In essence, this practice allows the employer to log in to the applicant’s personal account as if it were the applicant, providing access to not only his or her account, but also to certain information on the pages of the applicant’s friends, most of whom presumably have set up their accounts with privacy settings limiting access to this information. The ACLU compared the Maryland DOC practice as equivalent to requiring the applicant to allow access to personal phone calls as a condition of employment. While searching the internet for public information is likely fair game, the ACLU contends that requiring access to private information is an unwarranted and illegal invasion of privacy. Regardless of the ACLU’s allegations, it is almost certainly a violation of the Facebook user agreement, which requires that a user not allow others to access his or her account.
The Social Media Task Force would like to know what you think. Does the practice engaged in by the Maryland Department of Corrections and other public or private employers violate any state or federal privacy rights? How should we advise our clients if they are considering implementing a similar policy?